Lucene search

Fluid AttacksCVE-2023-49271

HistoryDec 20, 2023 - 8:15 p.m.

CVE-2023-49271

2023-12-2020:15:19

CWE-79

Fluid Attacks

web.nvd.nist.gov

cve-2023-49271

hotel management v1.0

cross-site scripting

authenticated

reflected xss

reservation.php

nvd

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

Percentile

14.0%

JSON

Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The ‘check_out_date’ parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application’s response.

Affected configurations

Nvd

Node

kashiparahotel_managementMatch1.0

VendorProductVersionCPE
kashiparahotel_management1.0cpe:2.3:a:kashipara:hotel_management:1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
kashipara	hotel_management	1.0	cpe:2.3:a:kashipara:hotel_management:1.0:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Hotel Management",
    "vendor": "Kashipara Group",
    "versions": [
      {
        "status": "affected",
        "version": "1.0"
      }
    ]
  }
]

References

fluidattacks.com/advisories/lang/

www.kashipara.com/